docs: def change_management_key(
          ctx, management_key, pin, new_management_key, touch, protect, generate,
          force):
      """
      Change the management key.
  
      Management functionality is guarded by a 24 byte management key.
      This key is required for administrative tasks, such as generating key pairs.
      A random key may be generated and stored on the YubiKey, protected by PIN.
      """
      controller = ctx.obj['controller']
  
      pin_verified = _ensure_authenticated(
          ctx, controller, pin, management_key,
          require_pin_and_key=protect,
          mgm_key_prompt='Enter your current management key '
                         '[blank to use default key]',
          no_prompt=force)
  
      if new_management_key and generate:
          ctx.fail('Invalid options: --new-management-key conflicts with '
                   '--generate')
  
      # Touch not supported on NEO.
      if touch and controller.version < (4, 0, 0):
          ctx.fail('Require touch not supported on this YubiKey.')
  
      # If an old stored key needs to be cleared, the PIN is needed.
      if not pin_verified and controller.has_stored_key:
          if pin:
              _verify_pin(ctx, controller, pin, no_prompt=force)
          elif not force:
              click.confirm(
                      'The current management key is stored on the YubiKey'
                      ' and will not be cleared if no PIN is provided. Continue?',
                      abort=True, err=True)
  
      if not new_management_key and not protect:
          if generate:
              new_management_key = generate_random_management_key()
  
              if not protect:
                  click.echo(
                      'Generated management key: {}'.format(
                          b2a_hex(new_management_key).decode('utf-8')))
  
          elif force:
              ctx.fail('New management key not given. Please remove the --force '
                       'flag, or set the --generate flag or the '
                       '--new-management-key option.')
  
          else:
              new_management_key = click.prompt(
                  'Enter your new management key',
                  hide_input=True, confirmation_prompt=True, err=True)
  
      if new_management_key and type(new_management_key) is not bytes:
          try:
              new_management_key = a2b_hex(new_management_key)
          except Exception:
              ctx.fail('New management key has the wrong format.')
  
      try:
          controller.set_mgm_key(
              new_management_key, touch=touch, store_on_device=protect)
      except APDUError as e:
          logger.error('Failed to change management key', exc_info=e)
          ctx.fail('Changing the management key failed.')